88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9

Analysis

max time kernel
59s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
Size 5.4MB
Sample260818-e53mjafd29
SHA256 88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9
MD5 7769c2773616ae86f7ab4b83f57f81a1
SHA1 11c60d18bad7b4489f6871fbff0a625060573094
SHA512 e1f1fdf43b878bfeefdef6aed8461622b4ec94a13a10e88a71997099aabfcb13faad407458b4af3b66542853869823bfebaf73d8b905adbb7279ea99cc3a5fa6
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrc:k7ICteErownP0oTcMsABqlkgcz4
TLSH
T14C463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uo1x46.exe	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uo1x46.exe	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe

Executes dropped EXE 2 IoCs

pid	Process
5000	83bq42xq.exe
2804	83bq42xq.exe

Loads dropped DLL 22 IoCs

pid	Process
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
2804	83bq42xq.exe
2804	83bq42xq.exe
2804	83bq42xq.exe
2804	83bq42xq.exe
2804	83bq42xq.exe
2804	83bq42xq.exe
2804	83bq42xq.exe
2804	83bq42xq.exe
2804	83bq42xq.exe
2804	83bq42xq.exe
2804	83bq42xq.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\e5o4zbqm\\83bq42xq.exe"	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
171	ifconfig.me
311	ifconfig.me
531	ifconfig.me
592	ifconfig.me
593	ifconfig.me
627	ifconfig.me
1429	ifconfig.me
2060	ifconfig.me
235	ifconfig.me
411	ifconfig.me
611	ifconfig.me
1810	ifconfig.me
2129	ifconfig.me
2215	ifconfig.me
2490	ifconfig.me
2518	ifconfig.me
49	ifconfig.me
175	ifconfig.me
196	ifconfig.me
213	ifconfig.me
241	ifconfig.me
284	ifconfig.me
789	ifconfig.me
2417	ifconfig.me
108	ifconfig.me
161	ifconfig.me
387	ifconfig.me
528	ifconfig.me
878	ifconfig.me
1820	ifconfig.me
2381	ifconfig.me
2523	ifconfig.me
234	ifconfig.me
464	ifconfig.me
1050	ifconfig.me
1106	ifconfig.me
1956	ifconfig.me
2409	ifconfig.me
2584	ifconfig.me
54	ifconfig.me
92	ifconfig.me
112	ifconfig.me
331	ifconfig.me
484	ifconfig.me
1562	ifconfig.me
1634	ifconfig.me
1891	ifconfig.me
261	ifconfig.me
308	ifconfig.me
604	ifconfig.me
970	ifconfig.me
1273	ifconfig.me
1557	ifconfig.me
2405	ifconfig.me
2467	ifconfig.me
646	ifconfig.me
668	ifconfig.me
2421	ifconfig.me
355	ifconfig.me
359	ifconfig.me
407	ifconfig.me
838	ifconfig.me
120	ifconfig.me
540	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1916	cmd.exe
8900	cmd.exe
4164	cmd.exe
6752	cmd.exe
6940	cmd.exe
2100	cmd.exe
6056	cmd.exe
6412	cmd.exe
6804	cmd.exe
7280	cmd.exe
3872	cmd.exe
6044	cmd.exe
6768	cmd.exe
7808	cmd.exe
7300	cmd.exe
5228	cmd.exe
5292	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4464	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4948	4800	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe	85
PID 4948 wrote to memory of 3872	4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe	86
PID 3872 wrote to memory of 4852	3872	cmd.exe	89
PID 5000 wrote to memory of 2804	5000	83bq42xq.exe	92
PID 4948 wrote to memory of 2724	4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe	93
PID 2724 wrote to memory of 4012	2724	msedge.exe	94
PID 4948 wrote to memory of 3036	4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe	95
PID 2724 wrote to memory of 4464	2724	msedge.exe	96
PID 2724 wrote to memory of 3196	2724	msedge.exe	97
PID 2724 wrote to memory of 3196	2724	msedge.exe	97
PID 2724 wrote to memory of 3196	2724	msedge.exe	97
PID 2724 wrote to memory of 3228	2724	msedge.exe	98
PID 2724 wrote to memory of 3228	2724	msedge.exe	98
PID 2804 wrote to memory of 4164	2804	83bq42xq.exe	99
PID 2724 wrote to memory of 2728	2724	msedge.exe	100
PID 2724 wrote to memory of 2572	2724	msedge.exe	101
PID 2724 wrote to memory of 2728	2724	msedge.exe	100
PID 2724 wrote to memory of 2728	2724	msedge.exe	100
PID 2724 wrote to memory of 2572	2724	msedge.exe	101
PID 2724 wrote to memory of 2572	2724	msedge.exe	101
PID 2724 wrote to memory of 5032	2724	msedge.exe	103
PID 2724 wrote to memory of 3084	2724	msedge.exe	104
PID 2724 wrote to memory of 5032	2724	msedge.exe	103
PID 2724 wrote to memory of 5032	2724	msedge.exe	103
PID 2724 wrote to memory of 3084	2724	msedge.exe	104
PID 2724 wrote to memory of 3084	2724	msedge.exe	104
PID 2724 wrote to memory of 3812	2724	msedge.exe	105
PID 2724 wrote to memory of 3812	2724	msedge.exe	105
PID 2724 wrote to memory of 3812	2724	msedge.exe	105
PID 4948 wrote to memory of 4808	4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe	107
PID 2724 wrote to memory of 4548	2724	msedge.exe	108
PID 2724 wrote to memory of 4548	2724	msedge.exe	108
PID 2724 wrote to memory of 4548	2724	msedge.exe	108
PID 4948 wrote to memory of 4244	4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe	110
PID 4164 wrote to memory of 2832	4164	cmd.exe	111
PID 2724 wrote to memory of 3852	2724	msedge.exe	112
PID 2724 wrote to memory of 3852	2724	msedge.exe	112
PID 2724 wrote to memory of 3852	2724	msedge.exe	112
PID 2724 wrote to memory of 2600	2724	msedge.exe	113
PID 2724 wrote to memory of 2600	2724	msedge.exe	113
PID 4948 wrote to memory of 1440	4948	88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe	114

Views/modifies file attributes 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2832	attrib.exe
5172	attrib.exe
5540	attrib.exe
6476	attrib.exe
7004	attrib.exe
6120	attrib.exe
7464	attrib.exe
8036	attrib.exe
2792	attrib.exe
6868	attrib.exe
6760	attrib.exe
6936	attrib.exe
5544	attrib.exe
4852	attrib.exe
5408	attrib.exe
7036	attrib.exe
7752	attrib.exe

C:\Users\Admin\AppData\Local\Temp\88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
"C:\Users\Admin\AppData\Local\Temp\88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe
  "C:\Users\Admin\AppData\Local\Temp\88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e5o4zbqm\83bq42xq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e5o4zbqm\83bq42xq.exe"
      4⤵
      Views/modifies file attributes
      PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ff8c76dc188,0x7ff8c76dc194,0x7ff8c76dc1a0
      4⤵
      PID:4012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,17525726439978855025,552813179752511279,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
      4⤵
      System Time Discovery
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,2872844465318001808,6914531420746307136,262144 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,7458058655987495432,2126677102466721888,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,17985200526067327661,4207553766696212375,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,2633716527603281721,8506564952241913892,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,4284136802179501787,13152785124299774689,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4128,i,1670525759203162857,7166222159829329844,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4308,i,14332274431649259359,5189386749665355514,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5272,i,10525132001258711803,1985021269293881546,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5528,i,6510186064286895264,7462286860941256012,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,2763464575275999346,6153982439258139807,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5824,i,12883401140133451041,10919594746933141277,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5476,i,11655627083134955663,7088185870019010055,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,269750559650510229,2566029915685332492,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6292,i,12164642346373622861,15633766142129695977,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,1603412131205605730,7867132334263915561,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,10540775812276028232,11851526299803586306,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6940,i,13195419027856775184,17156289413492745023,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5132,i,10381264780785482254,3294303812411956843,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7188,i,6579718760375230532,14033718052995243010,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7248,i,5766397502119903018,321516406540822343,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7552,i,4982192315821566481,7505685047494404489,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7560,i,6758668341342648724,7941218762408644459,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7948,i,3878802313377539510,10047514854899605773,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9300,i,792694044820617501,4378921126824594594,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:8
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9300,i,792694044820617501,4378921126824594594,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:8
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8272,i,14370968906474237690,15337984004008235933,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:1
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5132,i,6775039209237489950,849158122662978341,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7556,i,1490694340831247140,13524967994359369488,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8308,i,12077364960781510445,5918184310626680483,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8340,i,14353440216739266784,346444795526895729,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8364,i,14751007052600122662,7692265269767241644,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8448,i,18179975087895789937,15026210059185296792,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
      4⤵
      PID:7672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8468,i,10030708912401190275,305484038823312141,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11392 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8512,i,16416525493509597994,4294427588323008322,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11328 /prefetch:1
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8520,i,11776867128486690925,3003850111352211352,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11380 /prefetch:1
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8540,i,4261082385219968087,2906437971623184780,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11500 /prefetch:1
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8572,i,12655340145423881176,3649907695163652863,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11536 /prefetch:1
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8712,i,8059972245283107185,8103988588964116281,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11572 /prefetch:1
      4⤵
      PID:7688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8744,i,6486068048725674028,17402206161218288281,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11608 /prefetch:1
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8788,i,14162410209835944445,9887103453178560622,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11644 /prefetch:1
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8580,i,1468979540243398379,11688946834002684707,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11680 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8868,i,17629575496283369037,15994768398950831603,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11716 /prefetch:1
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8820,i,15305674842778871477,12709089718257344140,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11752 /prefetch:1
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9000,i,18104415088715320315,10574056109441022642,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11824 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9040,i,11625318995791695913,17273671443675560636,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11924 /prefetch:1
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8940,i,12529280503817804956,13053027126086138609,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11788 /prefetch:1
      4⤵
      PID:8200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9140,i,11456393938959482158,13079646899540169447,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11860 /prefetch:1
      4⤵
      PID:8208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9156,i,15983643441391313458,16894229069451520552,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11984 /prefetch:1
      4⤵
      PID:8216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9236,i,823125392965853676,11052055573275636320,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11900 /prefetch:1
      4⤵
      PID:8224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9264,i,14317804660502798354,4975413913185659232,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=11968 /prefetch:1
      4⤵
      PID:8232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9380,i,9749400961972582140,6581631779071739903,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12040 /prefetch:1
      4⤵
      PID:8240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9420,i,12707672404117597382,1412737197645500992,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12188 /prefetch:1
      4⤵
      PID:8248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9448,i,1038248431940857871,9514076031108062645,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12192 /prefetch:1
      4⤵
      PID:8256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9432,i,4306520215150807945,13240676425002649182,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12204 /prefetch:1
      4⤵
      PID:8264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9528,i,14606929406102578104,17581176564286891843,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12264 /prefetch:1
      4⤵
      PID:8272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=9472,i,9274746536615449779,6878670063516260467,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12260 /prefetch:1
      4⤵
      PID:8280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9584,i,4247301286268677668,5393375388772917899,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12156 /prefetch:1
      4⤵
      PID:8288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9592,i,9438097165787834528,483426035957453399,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12308 /prefetch:1
      4⤵
      PID:8296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9668,i,11603382157826601126,6353297307688809025,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12412 /prefetch:1
      4⤵
      PID:8304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9624,i,11786135235007536617,4661791788448935430,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12320 /prefetch:1
      4⤵
      PID:8312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9728,i,9858086598742910213,7169340600661136105,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12312 /prefetch:1
      4⤵
      PID:8320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9744,i,13017804983332047195,13678693767231089688,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12392 /prefetch:1
      4⤵
      PID:8328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9880,i,8193631324854959931,2522970746662337512,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12520 /prefetch:1
      4⤵
      PID:8336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9920,i,2477524716343430690,16817599209207742745,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12512 /prefetch:1
      4⤵
      PID:8352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9852,i,6872778128315140900,729712526580565985,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12404 /prefetch:1
      4⤵
      PID:8344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9968,i,13476892851778179598,559598471304438528,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12488 /prefetch:1
      4⤵
      PID:8364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9896,i,7862241089605720819,11071265303066550444,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12528 /prefetch:1
      4⤵
      PID:8360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10068,i,6492349608849477629,4630847665785402650,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
      4⤵
      PID:9752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10092,i,1129542429185528081,9180635935231367931,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12828 /prefetch:1
      4⤵
      PID:9760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10132,i,2609989644459423244,2155763608781378524,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12932 /prefetch:1
      4⤵
      PID:9768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10144,i,9030021324860194391,14906177583344738413,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12968 /prefetch:1
      4⤵
      PID:9776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10136,i,16762041572329903710,2106768312474463215,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13004 /prefetch:1
      4⤵
      PID:9784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10180,i,14726524556094647316,9777502685020904210,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13040 /prefetch:1
      4⤵
      PID:9792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=4620,i,7459031043516696937,8369309970554213587,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13076 /prefetch:1
      4⤵
      PID:9800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=10380,i,7954444836040962706,4018424536990183784,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13112 /prefetch:1
      4⤵
      PID:9808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=10400,i,15298338738320507906,12624716955790998103,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13148 /prefetch:1
      4⤵
      PID:9816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10420,i,6951108460888314199,9548793101562045020,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13184 /prefetch:1
      4⤵
      PID:9824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10404,i,2329554951648093010,4583408550675366985,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13220 /prefetch:1
      4⤵
      PID:9832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10476,i,1030008832384471357,16146409874502188322,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13256 /prefetch:1
      4⤵
      PID:9840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10508,i,12921333706936818013,7629162068521317154,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13292 /prefetch:1
      4⤵
      PID:9848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10556,i,6379827001985016541,4193375628292094221,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=12864 /prefetch:1
      4⤵
      PID:9856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10888,i,9301993922116862426,1744884333954221189,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:1
      4⤵
      PID:9864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10548,i,483503438829301924,5455713108549342387,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:1
      4⤵
      PID:9872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10768,i,18115399796005925970,14070777291015370460,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
      4⤵
      PID:9880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10752,i,15736507948820719477,17251461726863320283,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:1
      4⤵
      PID:9888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10756,i,6053735712627041885,11997552616189335156,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13328 /prefetch:1
      4⤵
      PID:9896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10764,i,11004491234489314729,9484975690214645928,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13364 /prefetch:1
      4⤵
      PID:9904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10700,i,6136919754654645025,10826787230562839528,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13400 /prefetch:1
      4⤵
      PID:9912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=11008,i,14054127959002063767,3821910620178278358,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13436 /prefetch:1
      4⤵
      PID:9920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10920,i,16375324871459782417,2591438208228428170,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13472 /prefetch:1
      4⤵
      PID:9928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10972,i,15720631880671736618,3140646278990959663,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13508 /prefetch:1
      4⤵
      PID:9936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=11144,i,7689441053661701864,1479722488737478934,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13544 /prefetch:1
      4⤵
      PID:9944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=6156,i,18381768586804208748,13244554913748256812,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13580 /prefetch:1
      4⤵
      PID:9952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=6232,i,17222535368615410005,16301679186061877214,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13616 /prefetch:1
      4⤵
      PID:9960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=6180,i,10394075598910208664,10706891049450349170,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13652 /prefetch:1
      4⤵
      PID:9968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=6160,i,10870892131275504886,11170099037725580758,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13688 /prefetch:1
      4⤵
      PID:9976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11168,i,3449515193386979090,3067838563338641442,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13724 /prefetch:1
      4⤵
      PID:9984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=6188,i,8741577241987083267,13852712312660617795,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13760 /prefetch:1
      4⤵
      PID:9992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=5576,i,4985258932701351042,8292331068652352643,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13796 /prefetch:1
      4⤵
      PID:10000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=5560,i,17490536722234992769,9268791146937852053,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13832 /prefetch:1
      4⤵
      PID:10008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=5608,i,530228148819986360,14522556310613510694,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13868 /prefetch:1
      4⤵
      PID:10016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=5540,i,6302634307780541323,5696728426396412664,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13904 /prefetch:1
      4⤵
      PID:10024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=5604,i,4908852063011333355,666693849605749772,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13940 /prefetch:1
      4⤵
      PID:10032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,2732925237328321446,11615887305547105612,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=13976 /prefetch:8
      4⤵
      PID:10040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11200,i,10046643487665077715,13118758946253396649,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14020 /prefetch:1
      4⤵
      PID:10048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=11228,i,5265382612422114896,8396949017439981865,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14048 /prefetch:1
      4⤵
      PID:10056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=11248,i,17145185291396005455,7532374084152870632,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14084 /prefetch:1
      4⤵
      PID:10064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11292,i,14952965519170572047,13803278437735392794,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14120 /prefetch:1
      4⤵
      PID:10072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=11316,i,16651953681580412578,4236431270379353530,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14156 /prefetch:1
      4⤵
      PID:10080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11344,i,5247139875178420035,1536416449451378347,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14192 /prefetch:8
      4⤵
      PID:10088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11352,i,14880341880020208761,11454471112585975936,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14184 /prefetch:8
      4⤵
      PID:10096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11356,i,5643404218305930341,5626355526265532068,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14212 /prefetch:8
      4⤵
      PID:10104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=11348,i,1016805735506783711,17343604073767142258,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14224 /prefetch:1
      4⤵
      PID:10112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=11308,i,353622607556397390,15482270851181875610,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14236 /prefetch:1
      4⤵
      PID:10120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=5528,i,4638002869406263142,2527331107521462566,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14252 /prefetch:1
      4⤵
      PID:10128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=7364,i,7952777035577260179,10999163021524798695,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14264 /prefetch:1
      4⤵
      PID:10136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=5956,i,8252655893790711890,7368083191185927014,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14284 /prefetch:1
      4⤵
      PID:10144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=6952,i,12178769211142425836,12981732355967763180,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14304 /prefetch:1
      4⤵
      PID:10152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=11428,i,7856364032495749595,4965228638501340830,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14456 /prefetch:1
      4⤵
      PID:10160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=2808,i,4271532942681283484,16760199472637568390,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=14460 /prefetch:1
      4⤵
      PID:10168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=8100,i,12842826710303110530,15610684714106167625,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=17888 /prefetch:1
      4⤵
      PID:10176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12764,i,3471372843366492101,15877148378397392499,524288 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=17872 /prefetch:8
      4⤵
      PID:10184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=12816,i,17321683858819234336,7615905448504537180,2097152 --field-trial-handle=2236,i,8623356765887259541,3473212898998287212,262144 --variations-seed-version --mojo-platform-channel-handle=17892 /prefetch:1
      4⤵
      PID:10192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1440

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e5o4zbqm\83bq42xq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e5o4zbqm\83bq42xq.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e5o4zbqm\83bq42xq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e5o4zbqm\83bq42xq.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3yr90dl\v7akz4t0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3yr90dl\v7akz4t0.exe"
      4⤵
      Views/modifies file attributes
      PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3388

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3yr90dl\v7akz4t0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3yr90dl\v7akz4t0.exe
1⤵
PID:1724
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3yr90dl\v7akz4t0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3yr90dl\v7akz4t0.exe
  2⤵
  PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3hqe3iu\922npl3k.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5228
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3hqe3iu\922npl3k.exe"
      4⤵
      Views/modifies file attributes
      PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5540

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3hqe3iu\922npl3k.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3hqe3iu\922npl3k.exe
1⤵
PID:5804
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3hqe3iu\922npl3k.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3hqe3iu\922npl3k.exe
  2⤵
  PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p81pho2n\tfwb3i31.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6044
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p81pho2n\tfwb3i31.exe"
      4⤵
      Views/modifies file attributes
      PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4200

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p81pho2n\tfwb3i31.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p81pho2n\tfwb3i31.exe
1⤵
PID:6000
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p81pho2n\tfwb3i31.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p81pho2n\tfwb3i31.exe
  2⤵
  PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1gyej67c\dhwfi911.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5292
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1gyej67c\dhwfi911.exe"
      4⤵
      Views/modifies file attributes
      PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5452

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1gyej67c\dhwfi911.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1gyej67c\dhwfi911.exe
1⤵
PID:5832
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1gyej67c\dhwfi911.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1gyej67c\dhwfi911.exe
  2⤵
  PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w846in4g\vwe8uwue.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6056
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w846in4g\vwe8uwue.exe"
      4⤵
      Views/modifies file attributes
      PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2792

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w846in4g\vwe8uwue.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w846in4g\vwe8uwue.exe
1⤵
PID:6272
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w846in4g\vwe8uwue.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w846in4g\vwe8uwue.exe
  2⤵
  PID:6352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lqt1qz15\26wgbfrv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6412
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lqt1qz15\26wgbfrv.exe"
      4⤵
      Views/modifies file attributes
      PID:6476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7000

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lqt1qz15\26wgbfrv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lqt1qz15\26wgbfrv.exe
1⤵
PID:6576
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lqt1qz15\26wgbfrv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lqt1qz15\26wgbfrv.exe
  2⤵
  PID:6664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uhx7hcvf\5zt6k8uf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6752
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uhx7hcvf\5zt6k8uf.exe"
      4⤵
      Views/modifies file attributes
      PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6468

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uhx7hcvf\5zt6k8uf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uhx7hcvf\5zt6k8uf.exe
1⤵
PID:6640
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uhx7hcvf\5zt6k8uf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uhx7hcvf\5zt6k8uf.exe
  2⤵
  PID:6740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z51vejb9\6piya7k5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6804
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z51vejb9\6piya7k5.exe"
      4⤵
      Views/modifies file attributes
      PID:6868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6420

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z51vejb9\6piya7k5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z51vejb9\6piya7k5.exe
1⤵
PID:6660
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z51vejb9\6piya7k5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z51vejb9\6piya7k5.exe
  2⤵
  PID:6888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bna4bzjo\ulwzmqrd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6940
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bna4bzjo\ulwzmqrd.exe"
      4⤵
      Views/modifies file attributes
      PID:7004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6976

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bna4bzjo\ulwzmqrd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bna4bzjo\ulwzmqrd.exe
1⤵
PID:7152
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bna4bzjo\ulwzmqrd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bna4bzjo\ulwzmqrd.exe
  2⤵
  PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\411sg7qw\bx5k6xjo.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6768
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\411sg7qw\bx5k6xjo.exe"
      4⤵
      Views/modifies file attributes
      PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2320

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\411sg7qw\bx5k6xjo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\411sg7qw\bx5k6xjo.exe
1⤵
PID:5320
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\411sg7qw\bx5k6xjo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\411sg7qw\bx5k6xjo.exe
  2⤵
  PID:6728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pqv3utr\azsfba7o.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2100
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pqv3utr\azsfba7o.exe"
      4⤵
      Views/modifies file attributes
      PID:6760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6196

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pqv3utr\azsfba7o.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pqv3utr\azsfba7o.exe
1⤵
PID:5868
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pqv3utr\azsfba7o.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pqv3utr\azsfba7o.exe
  2⤵
  PID:6828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l40y9to\v2r72zlb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1916
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l40y9to\v2r72zlb.exe"
      4⤵
      Views/modifies file attributes
      PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7396

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l40y9to\v2r72zlb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l40y9to\v2r72zlb.exe
1⤵
PID:7044
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l40y9to\v2r72zlb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l40y9to\v2r72zlb.exe
  2⤵
  PID:5596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4wiqo85i\qx5knc07.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7280
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4wiqo85i\qx5knc07.exe"
      4⤵
      Views/modifies file attributes
      PID:7464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8080

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4wiqo85i\qx5knc07.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4wiqo85i\qx5knc07.exe
1⤵
PID:7592
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4wiqo85i\qx5knc07.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4wiqo85i\qx5knc07.exe
  2⤵
  PID:7724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gn3r1wls\5oi3vu3u.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7808
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gn3r1wls\5oi3vu3u.exe"
      4⤵
      Views/modifies file attributes
      PID:8036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7636

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gn3r1wls\5oi3vu3u.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gn3r1wls\5oi3vu3u.exe
1⤵
PID:7292
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gn3r1wls\5oi3vu3u.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gn3r1wls\5oi3vu3u.exe
  2⤵
  PID:7440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\imhs34ud\zrcmnjbi.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7300
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\imhs34ud\zrcmnjbi.exe"
      4⤵
      Views/modifies file attributes
      PID:7752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5260

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\imhs34ud\zrcmnjbi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\imhs34ud\zrcmnjbi.exe
1⤵
PID:8684
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\imhs34ud\zrcmnjbi.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\imhs34ud\zrcmnjbi.exe
  2⤵
  PID:8784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sa1dgru5\bo6br5n0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8900
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sa1dgru5\bo6br5n0.exe"
      4⤵
      Views/modifies file attributes
      PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

562abab3-3899-4e2a-9642-ed20a14038b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\562abab3-3899-4e2a-9642-ed20a14038b2.tmp
Size 12KB
SHA256 cc7c3d78e1ad9710e055ff3ff99d7c9753094dac329a9cd3ead114ee76119615
MD5 4ef3b071ca4ef5bfef92645bfce6356a
SHA1 b246431c992473d221ad2cf94de61970c3a2fb92
SHA512 fde3d30082c2bffad30c12cf094cd35159ccebf2dbc4c7d21678b792e8ed906d6827d4407218cd43ff604dc6547f72440cb6eabc0fec3570ff41a69c414f1991
SSDEEP 192:uuZlsN8jQ9tSsmtHQmiU1Drkodk03yO4+R5pbr9e4LItqbwqlxOJC:n7sN8ju+/FkckhOp3VeVdqlY4
TLSH
T15042393168796C3759E7A68AF84A37579FB4507BC9C81FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78dc6a84-b0bf-4169-97ac-995451228312.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\78dc6a84-b0bf-4169-97ac-995451228312.tmp
Size 12KB
SHA256 e3fd2e790269372ab8d98530e262ec26f5ad730f3e3845990a4ab721f77ab426
MD5 574542c416607bf415188d4de8a03557
SHA1 229e2ad7533a3f30f298976adee790ab8338b671
SHA512 70c124775d03d4298ea8bfd37a82d98c39509c5e50a1661457c6692deeac57dae56366dd01bddfd1b104dd59db1ccea79c01ceab8397117d5622141c984e8933
SSDEEP 192:uuZ3sN8jQ9tSsmtjQmiU1srkqjk03yO4+R5pbr9e4LItqbwqlxOJC:nVsN8ju+/akwkhOp3VeVdqlY4
TLSH
T10F42393168795C3759E7A68AF84A37579FB4507BC9C82FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

2650d52f-eb91-4b55-9b02-38dbd52f3d2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2650d52f-eb91-4b55-9b02-38dbd52f3d2a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 280KB
SHA256 c795e86e2182ca03afca58492c60a52b8b6ae812b95f2d477d9c9469747be3a0
MD5 1ed8514100eb8b5c63cdeb7cda1331f8
SHA1 5be771ba173951086ffc9aa3cda212b54cf9a299
SHA512 17e90877d943b3fa20c0da4d7ed1d7daeec4ad0f2e093448dc7c281f739a84adfdf880b384e7f8e6a3c21509f6f0bff95e473a06ed7d1ced52d02191b45b8bd6
SSDEEP 6144:5jlaR+FeUbuFjgHBWQkmJOKWrSIp1g9LTMD4Inf3W7:b+EbusBzk4OnSIpy9fIVf3o
TLSH
T18C54227DFADE93A079A147861ADFCE81D0BEFCC2956EF84BA6184539171F9C0CC69810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 38KB
SHA256 ae1b3b031128f844d86b6ba50b57da647410e99483a5b1ff3542cd9de587c243
MD5 b2f2bdc203810097abac1ee04c6af3d6
SHA1 01be48aebe26f6a1560cff82d869b5a4f5d6923c
SHA512 0a7f4e80296f3234ce6ec3ce8b7a753edb197ac6b15fcd3877f5ee3b53507035779d707bfd83015aa48f9e79005d8be0ce6276e923c51031f4194fe383e7ade2
SSDEEP 768:Jnte9CXM9YJBOYF1CA25gPUREdpz+tAENQIYQI6pYqFxeSL8kNL:JnteUMOBNXCAxMYeXYQXMDkNL
TLSH
T15003019BC67681F31A397C489D155F698EDC82BF316F8B96F04607C98A4DC05F2E5432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 43KB
SHA256 23527dd91c3842a9922b483c5d8c066e81ef9daddebf843beeb9060eef46b206
MD5 9919aa488e5957c9a473565c4de111ed
SHA1 8c72a709adf61bb299edd9fb5176e99fe032d079
SHA512 f5d48682bfc604e8e8742864c0890b0f6d277a495e69cb64a915fd1525461fca2e20fa350a7a80cfbaea134c9292010120d401a06a3ced96564dfd3aea5ad736
SSDEEP 768:Lhy5UT9ub0I7kRG4anF8Ly6ox9jnhecNDS+qp30//oLDWb2KnBrM5:LhyqeUG44t6gecNW+o30/Ea2
TLSH
T1E713F297A7114E2B3F3DA3CD581DE045AE48BAD0EA014CC18E7D69DAF1F60D3C54956C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 67KB
SHA256 46329ca0cdf320d7b3bf6c6ad81fd16ebbe39fea143c7700f0d809006b144c84
MD5 1477ae015a58a08f6c49126e00925d77
SHA1 5ea97858b2a3f56db9bdf47cab9f2f583d01dbd2
SHA512 8b827399a498c2419413dc9a151d2e2f6790bc1b67bb87d5c0ee67d9178cbc140cc4fc853a314fceceabb17e7a121576e0f68ad1c6451a82e7bb0725588ce0a0
SSDEEP 1536:gUylCXh1MfzyBHq3ve+lsuR+vb7gP4uNsLdrI4q01oWs7e:PDMfO83VKC+j7gP4QsLNNMWs7e
TLSH
T17F63017807AE4976393DDCD5168EE0178E490A2A455FC61F6BD83686F39FDFCE201288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 93KB
SHA256 329ad196557dfb23e145a6eacc674a7711705017fc105ae15487696d86fdf022
MD5 700825ed1124f4fbd2c7bda271e30eab
SHA1 82dd04261c5a2710eda72bb3e532b0cc5e7b90e9
SHA512 0bc83d425617d3adc28536929a76254df82c92552af75a1e73d87faa35a49276c04f715b67cddde4e52322eb9942f4c30ba3f3fd9c8068c8f7c1d2cf624fdb03
SSDEEP 1536:O6wFEtINcRdlKh6VDvyWki+APB1hMS5Q1FJqRGXlpJu66aIqbG8eqJvyyDFPP:SESaRdlYWDv7Xb1hMJ1FJqopRi8G4RX
TLSH
T1749312F46DE989089071A3C257DF9A14BBB30E1296066533BDCAEA3EF959C4B1DD0C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 105KB
SHA256 d937468e413a53654aed83483338154cb23ca25653fa8d46a989e0c1ab38063e
MD5 498156d97470930e2d6526c7da35f527
SHA1 f2a8f8e2196059d3d93fedf4c895c43d6210ccee
SHA512 442e0b0dc23f7f4aabb54039826d5c2d95a4e56e5b80a281257ebc02ebfbff8829508d69d31bab24e21ef9c5e83a5a4961a10d4ce017d17b378b842c41d481fb
SSDEEP 3072:EZLJfb80HIjnoc6V4bDCOguKeVvHZZztI8Ma7VbuS7uZ1:Itfb1bpcM8Ma7osuZ1
TLSH
T115B312A8208386E471CA94CBE63D9851FA310D7344A686CAE37E1D3E7B4D33E84757B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 158KB
SHA256 6c04af325cef515153465cb8b19bb93aec94dcf5d33537f8d95b475cf9284882
MD5 a95e2032d6882ce13d25f28489c793da
SHA1 9bbc45be6424dd709b17eae7b70235614a51dc24
SHA512 ae8a18dd243c5c8a6d46b0b151ce4f3bafda9d4dd9ebf7aa13f7da2d278a6d517774db97bc32ced243a15e572477f6c0403818fa646b7f9c84a6455e468882e0
SSDEEP 3072:dqzrleBAAmXxojKh2cauRn37QQIYDPrsdCBOEZqDxX+XBXtuNYYz:dqzrwcxM6HN37mYDPQQnqDxXKBXtk
TLSH
T18FF312530CFE623B9A5610D35276B85D3765E1908FF6DCB1E28E0D60EDB8B27084D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 219KB
SHA256 ca5b93497e6e274d2499b690f17a0bc33ed3738b1dc6ce71bcf89af24e61c8bd
MD5 b6c25f8ccbe00d0eaf13ff1a6533a0cf
SHA1 d733ffc69373c48426c8d5cfe362b67656292b55
SHA512 62f9d6a232f111fdd348aafac771fe4bbd81ec21e404b067b78762433f52ae2b556d500fe0f339fa972f57a1c3d4e9cc93db3f5db2333a3734f725cae650a613
SSDEEP 6144:6zsBIS3R1PzeGe3MZNsydCGTRfyRrvnKkAcU1z:6gOGzzeJ3MvsFqRfyFvd8
TLSH
T1F62423E086B35DB157369BBCDB23FC05732731B11A6E794AB7C74A47A11C42874EAB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6e0d80db6cf845adb39c58b194438fd81e16dfa2d1d37534d9d14e94f172f71f
MD5 1b04f1f8f378b959ab48f4e331fc2cfa
SHA1 a0eb2a9524806c6b331eedafda389c05f8b5a4ee
SHA512 8c70d2db740668f1828200fc860501bb27c8e24b65a0ba529302559f00a766357f742c817d4e5bb134afbb80e1ef103389b5f2b6b72f1ae5f8e4e1b67e28fe0e
SSDEEP 192:sxZJ7R/yM/jK1Ml8Mj5/fcsqZPEdp5GVFi/W6+WNiNTFgOzV7xjBfYBObCkQIgyJ:sxZtz75/fcsqZcECbQLxnfIO
TLSH
T1A652E856AA346AB78DDFD219F951BB53D6F54463D6900E44AAFCC91C00E2AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 303c11ad6b5e46c3c0cbdd3fb1fda96a7416bfe4ddce37616d0afbb0beaf7804
MD5 3f4999e51e5a515710324850b5c680f2
SHA1 f6fa01b519b8427d45549fc7f11b5a802968b631
SHA512 736fb0a39522a9de36093a83f91ae0f857598f76aef85cdcd383af7f0f2ca301503bfe01e1d1b708f2753c6af2786a25481e43fca55d3f9ada3f34a14b7b9ae0
SSDEEP 192:sxZJ7R/yM/jK1Ml8Mj5/fcszZEEdp5xVFi/W6+WNiNTFgOzV7xjBfYBObXOkQIgJ:sxZt975/fcszZ7hCbQLxnfIJ
TLSH
T10B52E916AA346AB78DDFD219F951BB57D6F54463D6900E44AEFCC91C00E2AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6e62549eb19555879aa66f8df0042cda4704ffd572142c9bb5c83165c2451e34
MD5 bda31f25fdf06dc4c44d674295d8ac72
SHA1 ca68c520a096c0288e0690ad5e0f160ee3508947
SHA512 5eb6f250e3dbb49cf6ec0976faa7038a3349e809e55d4a7cbcd060d4f5c75b00f3037b02bf8bf37287339e163869a1d249785526eaa630037a76420b5fea8784
SSDEEP 768:g28iJANWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnALl6opdTrokkCMUng5:g28iJANWvx76ru1jaQALocdgSMUs
TLSH
T1ADE2FA3B680CCB7E4F845E9CEC266F966ED801CB5A948D5447FA880C03C76EE51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b3aa016e84403044fae2391877a485966bcf238dcb83b4101b204cb2f02a611
MD5 19855dae39358c1272610f0cd30254ff
SHA1 ed8b10793aa5755cea51b4878c9863709c50b857
SHA512 0a72d1f17d88f00c6980dc583b1c4992a1c111fa9b602c96aec386d6a506ad05367ece18eb5ecd29a36e9b222e122eee52aa4dab254fca665f1ea74ca0cc5576
SSDEEP 96:KkOkKHK6TEPIkumW28mJ9Wk2K+TWi2yMERSxsgKN2uf:S3TEPIkumWlmJkk0TWi5MERSWvf
TLSH
T187916D1235BF42012D3F781D92959B6747427563392DA43B7BB844A60E6BE240DFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 121c7a8261737f47a8938ba805817909c4e3c6858bbb172a9969feeb8641ca06
MD5 c13ed4a63bab17ec772dace00eb0dbab
SHA1 7693ea60aed9e62e7e1ccef716aeb7aebbe03bcb
SHA512 d162e35ae8b402e866dda14bf8ab7022abf46bcf5cc229ff0bf31281804f501dc842743d6c00ab02568f20cf3ed4d9e64ea3821fe4a6fefb3d23b3fef3c39d12
SSDEEP 96:ZqONkIQsjpfmUTmDK5ih/cIPURHl8h4otop565D8BhPwivh50xy0SFYKEAxnO0BT:gONY6kDfQmiUyEQZ903yO4+TQi5o1U6
TLSH
T19002D7356C782CBB9EE3AE49F44737275FA5112FEA852F85D9E82A1C00C734C2746827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1ab5b52487929e2ce8d56bb5b03f4e995d702acc237e648b85888c8eec40ad27
MD5 f05562d1a62b8810dd8bc4a1615ae595
SHA1 04283195c8eaad53a28a5899fb7f5c523117d38d
SHA512 a4d0a7256d49fc21beaac2b4f67edc5efb42a4a9a89634e2b3b83dd91990b26f3c3ff17249eee141f91345ed036ced40e6b41f65afc2d6390bf4dcd133ce859a
SSDEEP 192:z6sN8cQ9tSsmtoQmiU1urkogk03yO4+R5pbr9e4cItqbwqlxOIC:z6sN8cu+KYkPkhOp3VeodqlYH
TLSH
T1C342293568795C3759E7A68AF88A37579FB4507BD8C85FD4E9D89B1C00C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 351cc9f6e7b03607fae016de4d3841fc8ea1798200cbf6a6679f168f78945d13
MD5 33ed792b754e1b9d1b9c6bfea7124e00
SHA1 b1dc49d4b846f3bacd78183a7b0c08823b5a6bc4
SHA512 a42e812b01eabfa91e022741ce0b04a89ce65f3fe7daf1040e07467417623c1711992f6b8fe91ba5c0ba3660367b125715b0e8d76ba45b71a7e641a384f78fb1
SSDEEP 192:zWsN8cQ9tSsmtnQmiU1nrk5xk03yO4+R5pbr9e4cItqbwqlxOJC:zWsN8cu+zlkfkhOp3VeodqlY4
TLSH
T1FB42293168796C3759E7A64AF88A37579FB4507BD9C86FD4E9D89B1C00C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 40b10471362c29d7eeb17d988f1f276b93ba70785f2d02b461a8bfec925089b9
MD5 5a25bde11782a4312cca706a2ec8112d
SHA1 90a5901a9010a42eb75a8357b00156d560296faf
SHA512 170d25e0cbb8273266b71e3bbae2d5588120767c427498d03d3cf29047f3d97f64880c0d4231e53fecadadd6523f380db5a89d1fc3a7c1784282e1f727a8f81c
SSDEEP 192:zUsN85Q9tSsmtnQmiU16rkl1k03yO4+R5pbr9e4cItqbwqlxOJC:zUsN85u+zEkTkhOp3VeodqlY4
TLSH
T14642297168795C3759E7A64AF88A37679FB4507BD8C85FD4E9D8AB1C00C738C270A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a64493bbe8113fabf0f17ca334d014ee84ff4c53b25859c0fccbcc26ffb3c7dc
MD5 afb5a1b0171c362e3800ba8d42458dbc
SHA1 1c7a37ac8c72a54c821016e72559df1c9487dada
SHA512 fcfbb573d2106b799e84a76cfdd42324cab94e2f9a9aa0c005c4b8c0375f92c51132431c6f32309fc7d11e50a398480146096a5083ccb17a93c9b0bd9e1c1422
SSDEEP 192:zmsN85Q9tSsmt2QmiU1ork3rk03yO4+R5pbr9e4cItqbwqlxOJC:zmsN85u+8ikbkhOp3VeodqlY4
TLSH
T14242393168795C3759E7A64AF88A37579FB4507BD8C85FD4E8D8AB1C00C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6ec6784263f901f8ef31f998de487c5dcb4a8d0a9e478dd64b3f978c3e0f65e7
MD5 1f9892a02ed720453a82c7b1b891dc19
SHA1 9837dc4329bfc74874589312367ce530ca662557
SHA512 ec040ec3d1bdedeb86e106f97dc5e14b50e9a6a48a91914ec0959e7400b68023e8f1dc5eef3c6bfd34e91862f61fc04dc1c37de96ed759081ac335e042b1b6c1
SSDEEP 192:zZtsN85Q9tSsmtaQmiU1xrkSmk03yO4+R5pbr9e4cItqbwqlxOJC:zHsN85u+sbk5khOp3VeodqlY4
TLSH
T176423A3168795C3759E7A64AF88A37579FB4507BD9C82FD4E9D8AB1C00C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9a68cf8f5f99492ab32a06e950c6f1fa89234b291710ebdd126b8aae2cafd393
MD5 27f4aac1d2b0c5f34396ce6d122bd68e
SHA1 04c244b9e00cb660a0b8678e295f5efc1150461a
SHA512 c627678ff8c7ad0c56a65c8f4575f822e9f5166599977f22e61380b0cfe21d0918ce189549386416b80eaa64f837ebe1c21676f53044b772fd46035971b87d4a
SSDEEP 192:zZgsN85Q9tSsmtpQmiU1Qrkzvk03yO4+R5pbr9e4cItqbwqlxOJC:zKsN85u+NOkbkhOp3VeodqlY4
TLSH
T19F423A3168796C3759E7A64AF88A37579FB4507BD9C82FD4E9D8AB1C00C738C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 287d1254c6b6b0c1067bfdd514c67f07f17ade6cb898e78c87a8840bde1e42ea
MD5 689a8e12b15385056678fee1040c3e5d
SHA1 148c5dd16c9383224730ec24f40310b2ecd67a4e
SHA512 b21fcbda17f4e51b317777232f1b3ecfeee0f14c226993d2073641047fe926cefb2bca2a255d1eef6b3013938f6efa2964dc90f577660167f416d9ade1a517d5
SSDEEP 192:zZtsN85Q9tSsmtJQmiU1srkVkk03yO4+R5pbr9e4LItqbwqlxOJC:zXsN85u+RWkekhOp3VeVdqlY4
TLSH
T1EA42383168795C2759E7B64AF88A37579FB4507BC8C82FD4E9D8AB1C00C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0f5a43e983cf2d800bca17663b7cf56508f72fcc1dab09cd1baafad499535a20
MD5 00fd9361c260396eb11c89e02c77a4b6
SHA1 168e639178918bd0d40a68f64c2597c69ba4f43f
SHA512 e2ef23d2db40e8b5be4c2bb3bdbe33c794cc565c2caada19cc2114449f89cbdfede64adc70625ead00d34b45004f3471f5d1eea58018c792384d087138c1fcba
SSDEEP 192:uuZ7sN85Q9tSsmtJQmiU1trkjuk03yO4+R5pbr9e4LItqbwqlxOJC:ndsN85u+RbkKkhOp3VeVdqlY4
TLSH
T12C42393168795C3759E7A64AF88A37679FB4507BD9C85FD4E9D89B1C00C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 39fdfd7936787e040da0727cc7c1bb48bf886b5a8ec4a171f50cb1c433028767
MD5 deebe9bd400b83034ae9bcf63958804a
SHA1 9048501712c3ab79537427a0a5f46e91c34ff675
SHA512 5f5bc97846916ada84adbd1eb8d7e6b461c87ed57f57e31b48cfcaf9a322be6303ee70062805ff970beece728920c25044a0a60761c147e3f27f764817b53260
SSDEEP 192:uuZ7sN85Q9tSsmtojdQmiU1qrk0hk03yO4+R5pbr9e4LItqbwqlxOJC:ndsN85u+QbUkIkhOp3VeVdqlY4
TLSH
T1DA42283168796C3759E7A64AF88A37679FB4507BD9C86FD4E9D89B1C00C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f2073b56bc481212effc80c9b0dcfbb90eac050ef64892afee5c30cccb61925e
MD5 44c931a45790cd78e4274567f0c65075
SHA1 20ff87d32ef146d40b629e589059beeb6749ca85
SHA512 496ef2953a14afae347b213327f9d41613ec23fe941cdecab64875a3a70900a5f6babc3a8c4ae1a2cb736b8722e38c9de56ac682bb1319d5562a8468cb0fd127
SSDEEP 192:uuZJsN8jQ9tSsmtQQmiU1Wrk4tk03yO4+R5pbr9e4LItqbwqlxOJC:nbsN8ju+uEk0khOp3VeVdqlY4
TLSH
T1FA42393168795C3759E7A68AF84A37579FB4507BC9C82FD8E9D8AB1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 22419fef567ef412b8ee9683888bd1eb81aff9168f3617409ce2218236039489
MD5 7dd5e3ce535778bf6be0d91b66be9ab8
SHA1 6f01c7dd645043bc1fbf56351392289a4617073b
SHA512 8d18b38d28735e4bdd9b24e69961bc82e7578e656e7cf1c617476ff397b4c8e28661e2edc4c355c0095b6aed977484754209d479300e7e56cc58784446b1b70b
SSDEEP 192:uuZKsN8jQ9tSsmtgQmiU1mrkjuk03yO4+R5pbr9e4LItqbwqlxOJC:nksN8ju+6Ak6khOp3VeVdqlY4
TLSH
T1E242393168795C3759E7A68AF84A37579FB4507BC9C82FD8E9D8AB1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 cab78c3378ad9e65ede07d792df142bb6ac1b8043fe83f79a7ac6ab82fff3910
MD5 ec02add619800d6b3bce98fabcfa660f
SHA1 2bec65fc73e58155b3c530783ff9ee3f6fef42c4
SHA512 1090b5d5f1b98354d0769261bda19990e8800c8470a2b724eec27edb8d7ab2436b6ebdd56c2a9a7dfc3cd8316f9caabb37b6dc3ff573539ea084381edb994f8a
SSDEEP 192:uuZbsN8jQ9tSsmtpQmiU1/rkBIk03yO4+R5pbr9e4LItqbwqlxOJC:nJsN8ju+RtkCkhOp3VeVdqlY4
TLSH
T1CD42393168795C3759E7A68AF84A37579FB4507BC9C82FD8E9D8AB1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 103e41400b56e1710f348f7791fe9fff7b0f9adee9aaba642aa81f224abfe8b7
MD5 4ed62664e0ca2da9d4f0c8082bf4c707
SHA1 d3eaba2749445bed3f250efdb1ff91d6d9a2a806
SHA512 59a0e8421862aa5a81270b09049b74c0934dfaf409231c718ba9146937fc303279ad834c435684bf5487db5c30edcfb31a380c3574528ab60d3b3e43e8c12aa7
SSDEEP 192:uuZTsN8jQ9tSsmtcQmiU1brk1Ek03yO4+R5pbr9e4LItqbwqlxOJC:nZsN8ju+6JkKkhOp3VeVdqlY4
TLSH
T1DF42493168795C3759E7A68AF84A37579FB4507BC9C81FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a8f1c60b5e789724322e978e402de3dd9709b748b12e4632cf37dadcfc6989dc
MD5 f64960fd6068f0199c175f400f0c3ac3
SHA1 c0c0e6ef795f67252dd9bc68e8b77cd8f17915f3
SHA512 565dfeaa0998b94208b7302e5dbb867948aafa92427ce7918fad9611df53da8e309aa727c2191589432d2a8dc09df06995bd0b13148b647f32c2c8e39519a512
SSDEEP 192:uuZWsN8jQ9tSsmtHQmiU1prkWXk03yO4+R5pbr9e4LItqbwqlxOJC:ncsN8ju+/rkYkhOp3VeVdqlY4
TLSH
T14442393168795C3759E7A68AF84A37579FB4507BC9C81FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 be7120c882b9f3536ac20a56220ad2b113d587eba4c34b5265e01ca9e4a565ce
MD5 f8554f75e283b3c5965b8dbdf47b1e71
SHA1 3e6624859d1b34a84755d4f8f436abc343e3b311
SHA512 fe3cf4be75e99156342096d28b3fc3d37c0c7e04ee873b77b195f6163eaa41a503ceeba2121ee1e8f68a709106375e79844951d6f7c84de8f4e6121fd5282d56
SSDEEP 192:uuZrsN8jQ9tSsmtPQmiU1QrkO/k03yO4+R5pbr9e4LItqbwqlxOJC:npsN8ju+nmkYkhOp3VeVdqlY4
TLSH
T19442393168796C3759E7A68AF84A37579FB4507BC9C81FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 302954f132bbc40297078dc5daa91c1950d5c390103094a50aab588a0fcdda69
MD5 59068126ed9eebd45daff268b2d5f757
SHA1 fb6003602a1323e7c448d647429fb60c54a39c93
SHA512 7d876e98303bcc8f5677dda6ce73e8c9052a136e099601e9b940a9c78e6310c340ec87ffe132c049036b58566ad4c28cf201b3eb720148567c2ce24c209fe877
SSDEEP 192:uuZrsN8jQ9tSsmtjQmiU1Prktsk03yO4+R5pbr9e4LItqbwqlxOJC:npsN8ju+/5k+khOp3VeVdqlY4
TLSH
T15542383168796C3759E7A68AF84A37579FB4507BC9C82FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9a7451d6b9ee583d8d7ca98bb0036f548ddc94f01e68176a5a167f6fe1c36270
MD5 4a694dfbb08ede6e149004d04f73c44d
SHA1 ef96777889c574d5e1d58c6f762f728603b30d45
SHA512 fdf81250dcd22a7ca50e806d4209377b0075bd23d634cba8e80cf565d0397b0bf300bcc8d314ee4bf23fbbcd495611b89defce053e10878e9097b738aeea27c3
SSDEEP 192:uuZkdsN8jQ9tSsmt4QmiU1QrkZQk03yO4+R5pbr9e4LItqbwqlxOJC:nusN8ju+yKkWkhOp3VeVdqlY4
TLSH
T11842393168795C3759E7A64AF84A37579FB4507BC9C81FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9fb16d5c00f42e5617cb9aa474dd9df9edbdec910dfa5d0eb8908d5959639845
MD5 1986daec65b636922a26eddb40b41116
SHA1 ebaad7411eb4655bd2189a078b30ad82fbeeb52c
SHA512 e8d4a0fed29b8f7a97da1e0a3994431ddd9ae2c5fe48d1e98c79f69f5ea5006f91352e1f9dd10f6b01dd933939e45fb1aac0d7d2efc9b716eec5448fb9aff265
SSDEEP 192:uuM8sN8WQ9tSsmtDQmiU1prkvik03yO4+R5pbr9e4LItqbwqlxOJC:npsN8Wu+vHkakhOp3VeVdqlY4
TLSH
T1CF42297168795C3759E7A68AF88A37579FB4507BC9C81FD8E9E89B1C00C739C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c614845f30d949b251f74146a66980d683356b21030b940dc194e385ff4e7bfe
MD5 94494cf7a7f17c3d270b571fc69e2692
SHA1 7be7d3cfe08e74215b3ff2ab833a659f69802846
SHA512 59878ed0af7ade91141e7cb16720a3e8e29b08b48f7e2ca815fd1f443f739c85ed0a97bd7306ce5b680d5f337cf0dbf7a7d14c40005613469dbd7bf088ac9993
SSDEEP 384:nfZcI1sN8Wu+rj9k4khOp3VeVdqySllYJTfY81FlkshBuG:31CpkOpgQZuTHMEBuG
TLSH
T14C928D712C395C7759EBF249B8867B0B5EF8907BC6C85FD4D8E89B1E01C729C171A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a92ee27158d349f0fb2bb5f04a4e31e2c7062862170703856ba0d1c5bd21a254
MD5 25bbbfa7d72419b9d82a4e57fdabd508
SHA1 847f14bb5b3c0666e4cc064fae6018554c8e7a64
SHA512 13f7cdf96c446688a5c80ccff713e53f84b4a8f047f7dc1b5d9c1dbd573ba9be7b2e7097ec8f67795047343dcc204feb3fea1e1374e66b724a7da7e8c21e36bf
SSDEEP 192:z6sN8QQ9tSsmtPQmiU1prk11k03yO4+R5pbr9e4cItqbwqlxOIC:z6sN8Qu+bPkPkhOp3VeodqlYH
TLSH
T10D42397168795C2759E7A64AF88A37579FB4507BC8C86FD8E9D85B1C00C738C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a1b16eb80213c02191c17bfd87984b68a591cf769b6d27b0c5974efe970b44b9
MD5 efea71a20bddb9c627e201e546866704
SHA1 5d39cc2ffd347599765772c1f595cecc54283a5b
SHA512 8032194afea9446f3d3a0ff723c74cdc209de06bfff04896db1e1f96d8109d1c45be98ebe41f38667bca2a3ac313db6fc44b7a5baa4b10662567f4a40824e1e3
SSDEEP 192:zWsN8cQ9tSsmtoQmiU18rkKOk03yO4+R5pbr9e4cItqbwqlxOJC:zWsN8cu+KGk7khOp3VeodqlY4
TLSH
T1CD42393168796C3759E7A64AF88A37579FB4507BD8C85FD4E9D89B1C01C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c836dd82131f5bdc4745fc47f020906cc26d9ef9727442522471f155455bc34f
MD5 4ce68539364262f86bfc8595098f2566
SHA1 9bda1e8480c6e3f3ffaf90692779733d89df7e02
SHA512 84a9cb3ddd247afbd93d2c4438961313eb7ffddbdb3a8131780ea284002590faab445649d7b29c176ab2284a6605641b744f0fddfbcd7bba29d5d99519baa6b0
SSDEEP 192:zmsN85Q9tSsmtWQmiU19rkGyk03yO4+R5pbr9e4cItqbwqlxOJC:zmsN85u+MLkhkhOp3VeodqlY4
TLSH
T12942393168796C3759E7A64AF88A37579FB4507BD8C81FD8E9D8AB1C00C738C270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2e883e46e3537c53a1e849bd9e82ebd3329448e3d7fde9a20915aad388c142cb
MD5 a4d06a641f278cc81a2e4bd91eb0c55d
SHA1 9b75200066865e65980d137c63daf6c77d708338
SHA512 e2311c9e14f1060660465343fbff5bd8e086f2107c03dd77cba5a691da8514b252a92b67e66e7b294e1f2b29b7c09b2886a74cee636e49bf9939460c95aff976
SSDEEP 192:uuMSsN8WQ9tSsmtDQmiU12rkQ1k03yO4+R5pbr9e4LItqbwqlxOJC:nPsN8Wu+bgkQkhOp3VeVdqlY4
TLSH
T12342283168795C3759EBA68AF84A37579FB4507BC9C81FD8E9D89B1C00C738C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bb8f517b4be6a6279f69c5a6d81279e9f74567147b8e38f2bcd3e53847b69ff7
MD5 e02ab374cec1be9f362e973fc3d46807
SHA1 e5026702b9a8631b49705a8dc53114520b107395
SHA512 5491648bb59111feb3060e81fa6e74848e9d3929165721a6027bacb1e0c58967021167c9cd89a7009b29f34a928636b7ee70cba07688861aa1c375a8c946c01b
SSDEEP 192:zZgsN85Q9tSsmtaQmiU1rrkEEk03yO4+R5pbr9e4cItqbwqlxOJC:zKsN85u+s1kJkhOp3VeodqlY4
TLSH
T18E423A3168795C3759E7A64AF88A37579FB4507BD9C82FD4E9D8AB1C00C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b9711d07d87be923c171ef21ece322732970d374f6f0a90ca57b46e6a6134201
MD5 29bad334633f7172d5f85b01364d271b
SHA1 48b658d80703c3034b5b0d24878e6eb1fabb2ab8
SHA512 214e1bce0f73d0b46900cc3b1f0e72c6ded8da04c6ab2696b53720e0ea2a685a5a2edcc97228fc91324216a419344fd49fc94cd453fe2e5803fce4ef556ebf75
SSDEEP 192:uuZ5gsN85Q9tSsmtojdQmiU1XrkRYk03yO4+R5pbr9e4LItqbwqlxOJC:nTgsN85u+Qb1kqkhOp3VeVdqlY4
TLSH
T12E42393168796C3759E7A68AF84A37579FB4507BC9C85FD4E9D89B1C01C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 928213276a6d37c911949d252b224ba46301f079fdf68fb44e137524438498f1
MD5 c53ed6ad0c5e95ed2a08335e49b75265
SHA1 5f2d10d67f80d014af90000a5e9570a29dda2723
SHA512 375a1ac69ed7d313b3db9ca1a30a5a71b50273c352a6444def34081c3b97beae5bf675669bb5115ad194e89db98a9dd58c4f887a632b6cae0c740b01a935002a
SSDEEP 192:uuZJsN8jQ9tSsmtKQmiU1JrkX6k03yO4+R5pbr9e4LItqbwqlxOJC:nbsN8ju+oLkKkhOp3VeVdqlY4
TLSH
T15442393168795C3759E7A68AF84A37579FB4507BC9C81FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e7f33e7140e7426305e3bc299e6fbfe7598d6f7748cba9343a13811f3a1cf793
MD5 fe90affbb5a1a380b7bcf2752dfe1c29
SHA1 47457289f5771994d745e0a034efeda98f19b255
SHA512 db58f2db530397914f6be3bca84dd28302073580b2c8ebf88439a7f5bf692633c51cb56a8cc73b6e72bc6b390f4be9adeb2ab32ff1ffca900c85f90f909fa529
SSDEEP 192:uuZkdsN8jQ9tSsmtcQmiU1Frkc5k03yO4+R5pbr9e4LItqbwqlxOJC:nusN8ju++TkYkhOp3VeVdqlY4
TLSH
T11E42393168795C3759E7A64AF84A37579FB4507BC9C81FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 744e8c3b52569357ad2b185594e76e042eca8cd97fdb8f5fa43364e213b27a99
MD5 95b1798e7e3c840dc3eb479d6be8c4d5
SHA1 4a3940fc3a80be7944be38f4f24fd26606190dc8
SHA512 dca1caae25cf6832f1216aeb577d466d0925893ee67bf5381d9770efaf75c7668c51d9404a6c1a14837aeeff7d56df31403962beffcfad827e54f8e5bbaeee1a
SSDEEP 192:uuZDsN8jQ9tSsmtDQmiU1krkV0k03yO4+R5pbr9e4LItqbwqlxOJC:n1sN8ju+vOkekhOp3VeVdqlY4
TLSH
T16142393168795C3759E7A64AF84A37579FB4507BC9C81FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fcc959638abd6f7df4226466aaf5889768d43587111b8b3b55f7f7ca036d6e51
MD5 c55ab751e99564bf46f55f32dedfe0f8
SHA1 13367411d6bf19329a43efdb8f44c4d8cec319fb
SHA512 c26c759e05adbfae090ff0554c5b331704cffa469aed58087ae85dc779ff5e6473baa743e4ea1fb2c199c5d883b368a466736ae307d159266c897674d987a4cf
SSDEEP 384:nfZcIGsN8Wu+KckCkhOp3VeVdqySllYJTfY81FlkshBuG:3GU2OpgQZuTHMEBuG
TLSH
T171927C712C295C7759EBF249B8867B0B5EF8907BC6C85FC4D8E89B1E01C729C171A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c86287083bae3360505281dccb46887da4c08167510c6ee74722c9b49832c8d1
MD5 b0de9e51e00ff77c607f47ab3a9f94b5
SHA1 7dcdee00e0d6641e328e3cb5c2be0e5ce2b043c1
SHA512 a622cd11762da6f84925cc657e827012811d675ef4d9d72507e4f2a479f58aa110635ac9b4e369471c56fba1daa63f008036caa1843733fa23931e44f5438b09
SSDEEP 192:uuMSsN8WQ9tSsmt5FQmiU1Drkdck03yO4+R5pbr9e4LItqbwqlxOJC:nPsN8Wu+rjBkikhOp3VeVdqlY4
TLSH
T1E542383168795C3759EBA68AF84A37579FB4507BC9C81FD8E9D89B1C00C738C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 1d894116127449c0c509744ef17d2b7d6d0236d6f020084ae440fa0b0e9249a8
MD5 35411080a4fc0efd1c1a5a5f0556255a
SHA1 7d2c45bca844e2dc09741472cb0e350a89603f96
SHA512 bbfae4146aa9ca13e5589910d6f4864a5a6b2322753098654016528bea524a01ff4baecd95c81cf0716302619504f90ecb56770b3603b919a9a80b03c4a6f707
SSDEEP 192:zrsN8VQ9tSsmtmQmiU17rkP8Uk03yO4+R5pbr9ewcItqbwqU8:zrsN8Vu+0dkPHkhOp3VeQdqU8
TLSH
T1F432173168799C374DE7A649F48B37A79FA4507BD9882FD4E8D85A1C00C738C271A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d3650e2eca01bd56ce94df3e684616004a987eac228c8fb51b0350469efa3059
MD5 aaf77e0d0a88050416e44d4b8cf74de3
SHA1 a6992c7cb00b86dc63a9d2ce8c2ebfc908e787f7
SHA512 77128222748f777e8eb7e4548bf5d591dff5d11487351f80b1c653c2e9f4d3d47b5f1fc40434a209a0da8f073f518d2562303934bad2fde8ce8966ab88dab598
SSDEEP 192:uuZ5gsN85Q9tSsmtQQmiU1krkCLk03yO4+R5pbr9e4LItqbwqlxOJC:nTgsN85u+uOk0khOp3VeVdqlY4
TLSH
T1CC42383168795C3759E7A68AF84A37579FB4507BC9C86FD8E9D8AB1C00C738C270A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b5f6ee424a24edd873b8087fb18effd9668f55c3b661bf4b53b1beab2fc94e98
MD5 61d8e235ae222118957ca8a59e07139f
SHA1 c79bacdf940286ef77e518c438238d37d17d442b
SHA512 de376adaf42a557d3d930cf46da17b1b1665fd0481054bb6812b0b8aa7ebd33b0996decc28f8024b5ffeb0c021cf8115ea2dbc680fefed810be8f8f1da2f1dc6
SSDEEP 192:uuZbsN8jQ9tSsmtgQmiU1SrkvSk03yO4+R5pbr9e4LItqbwqlxOJC:nhsN8ju+6MkakhOp3VeVdqlY4
TLSH
T17C42393168796C3759E7A68AF84A37579FB4507BC9C82FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b52d32efc2b4775f5ef33941b58597e0e7a625b6e10c58e7b15c443ecc08a7e4
MD5 2ecbb94cdf83a1c3bea2eb4d6df31bc5
SHA1 27a532722248bc4bc1ebf3e69fd0951de1fe98f6
SHA512 e1514d84561333163d5739fe21fbf424bb8f7641d72da607059d41850997aa595f99c768de0eba464358341d816e97c68c8853c0106682f27a9092bfad2bfee0
SSDEEP 192:uuZlsN8jQ9tSsmt+QmiU12rk5gk03yO4+R5pbr9e4LItqbwqlxOJC:n7sN8ju+0kkikhOp3VeVdqlY4
TLSH
T15542393168796C3759E7A68AF84A37579FB4507BC9C82FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 134b5de763999c6a5c31bc947aa6b4b7ca533d522da697360146404fc3da7021
MD5 f5f1d7af87d53f25053ab722cf32b26a
SHA1 95b2294a464822aca3bd36b7ee37cd9a846802cd
SHA512 c94fc970d933c3e38cec1762e7f99ba2b65a2af1e1d7ec32d6a926d6a8344f244051bdbf111729d4fdbdfeba49cf8afe6d3a1f0aa5564587d41c118a732b3bb2
SSDEEP 192:uuZDsN8jQ9tSsmtcQmiU1Prk2Hk03yO4+R5pbr9e4LItqbwqlxOJC:n1sN8ju++NkYkhOp3VeVdqlY4
TLSH
T1BB42393168795C3759E7A64AF84A37579FB4507BC9C81FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f7d8fda842f783e7e784a2740af4aaa60026283684e83ff1ecca915f017e8363
MD5 ee61317e97a02e61b917fbe75c30b8d4
SHA1 86de973ef089113b9a72926dc89d2ecaad6ed4a5
SHA512 12bcbcf655db56d2117c3a3f362e1a1f109e9370e6848b1489218ce218ba30a1c33325d81aafd33900eb3f0eb946753526e6cfc80f4a162fb1910df099198e79
SSDEEP 192:zRsN8yQ9tSsmtPQmiU1VrkWyk03yO4+R5pbr9e4cItqbwqlxObC:zRsN8yu+b/kDkhOp3VeodqlY2
TLSH
T1AF42397168795C2759E7A64AF88A37678FB4507BD8C86FD4E9D85B1C00C738C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 82ec166ff9886618273a2fe6b65a2b5110e276a17f0c3f2ee6631017019d4c2a
MD5 14e9c1e9a911f9b91cbbddc1aa6fd222
SHA1 97f05061b1aa89c7f99803e79dfd6905acef92d9
SHA512 02285e33a01e33d55280bbf3588189bb7a87c0a5555c23bf966e61e5f28de894042aada52c917a7cbe1b6d28b2351f728c2eb097ba2de168a5db8ac08ac19514
SSDEEP 192:uuZ5gsN8jQ9tSsmtQQmiU1vrkzstk03yO4+R5pbr9e4LItqbwqlxOJC:nTgsN8ju+uZkzMkhOp3VeVdqlY4
TLSH
T13B42383168795C3759E7A68AF84A37579FB4507BC9C82FD8E9D8AB1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 13d9b7c887d27d8138e56aea0a984642b00b6b5cf394ca2f15ed9b4910d35174
MD5 fa02373e035abcac7a1f597a43428bcc
SHA1 6827bef86956ba19e3922d09173dadebc697085f
SHA512 c3715c8c56b0fbfa24bc5f9d5a16e7a210731292b5a5f9f71a16b76a34a37debd2720aad1a1b82da1d9b1da60d495a48a22e00431b79a6a6aa8b815ad5201b0d
SSDEEP 192:vON16kLQmiUydQv903yO4+R5pbr9ewcRtqbwqU6:vON16g5v9hOp3VeJdqU6
TLSH
T1C6120831687C5C2B1DE3AA49F48733679EA5107BE9C96FD5E9D85A1C04C734C2B0E822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b5b8d780ffb57f068474e8a339dd7d5e0c51c4c67e740aa9ab1a03afd477a089
MD5 4050f34a5b938875496b58da39c9d0f7
SHA1 3fc04e8d23ecdd3b9eb7ce41868dccad11c22874
SHA512 2b99f20ba22ae5dac6ad3c97400480ebbaca7354532f90edbb255aa6b743fd47beb7a04c187382408b060465b3abcb591ac2a265d3adb7ee00a3220bd8072f9b
SSDEEP 192:uuZTsN8jQ9tSsmtpQmiU1OrkkRk03yO4+R5pbr9e4LItqbwqlxOJC:nZsN8ju+RIkEkhOp3VeVdqlY4
TLSH
T1D542393168795C3759E7A68AF84A37579FB4507BC9C82FD8E9D89B1C00C739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 f4ed9eeb5d6f45c5149a416e7ee77735feb4bb53d1d8d2f5cab728cec8600ebe
MD5 c789bf919f176073905d7cc72b28cbc0
SHA1 64fbea8e299bf7312314d5895f632872d5abe261
SHA512 1eafa506650e380c12a7b2cee79ad32ffcd4196ab26b16e7b088110eaba0f5358b646717c49eccc35dd5a69a516ab2f3690b45a822545077d824583404d5a611
SSDEEP 192:zrON86kmt0QmiU1urkBZk03yO4+R5pbr9ewcItqbwqU9:zrON86Z68kfkhOp3VeQdqU9
TLSH
T17322073168786C375DE7AA49F48733A39EA5107BD9886FD5E9D85B1C00C738C2B4A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6171546664c25aaf1d9dab2b5c9d8e47ec8a47edd78cd13df1f8f44b350adf69
MD5 b8a40f6200fe05e97d0362fed4dcb0f5
SHA1 075cc1ffe096d8727de22417897becde226c4441
SHA512 76c6f25e54870652ba5c501520ebb9f1c245fb97abf455b6c24dfaff3ac3f25b0a138e06a32319c624e999223018bd3b9618294d486ff5145ca972aa253b0360
SSDEEP 192:zRsN81fQ9tSsmtmQmiU1grkT/k03yO4+R5pbr9ewcItqbwqU8:zRsN8tu+0mkzkhOp3VeQdqU8
TLSH
T1E63218316879AC374DE7A649F48737A79FA4507BD9896FD8E8D85A1C00C738C271B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1c1be92-4b39-433c-82b5-166b3a9e3cfc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c1c1be92-4b39-433c-82b5-166b3a9e3cfc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7db370ffafadf33d11af475cb350f02e10a3d4965bb4c3ad04857e3c78bf15f6
MD5 f2f9b82a813bf12ce33d9937c072bb0e
SHA1 29d8621726c591ac2377bc2a7af6e3fd871ee0bd
SHA512 2a9a1b08e903caf79ec6bdffbc82a1e9014f5d0aafe0e40821ac5cadfee1265ce101c113153bd3084e04ff21c23c62f611426245316194cea2b5ad007c3c699a
TLSH
T141412B58A6E90148B3B77E5A9BF6B86E447FBD772E16C09D00110D4F0A22B00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\base_library.zip
Size 711KB
SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
MD5 9754aa61d43512e1d509cf27c451f8c6
SHA1 0a60bf1e7dc070649290f0cb0202495a5edae411
SHA512 4317fa5c28777e788b35edffcc26b50f35ee23a3f68ca184764897eb205df0b3d4a13369956673d92465f0aa8d846d614f79fc7c397608b8a7dd3c4c02996b86
SSDEEP 12288:ASoQDSKSfyEcNhyWaxb2osQNRs54PK4I16dSk1mPV0c/Q:toQDSTfyEchsb2osQNRs54PK4I16dSrq
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48002\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddcd8dfb-6ed9-4fe5-b686-9dd745ba1ba9.tmp

Path C:\Users\Admin\AppData\Local\Temp\ddcd8dfb-6ed9-4fe5-b686-9dd745ba1ba9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9a717065-89a2-4129-b5c8-078d496e433d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2724_1111235987\9a717065-89a2-4129-b5c8-078d496e433d.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cebd4522-e22f-41db-be5a-4aaa853ed922.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2724_1341400529\cebd4522-e22f-41db-be5a-4aaa853ed922.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83bq42xq.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e5o4zbqm\83bq42xq.exe
Size 5.4MB
SHA256 88bea56b46b0fb1f19c4894617b9e9568da9e5009997fa833d39fb1a1bf9d2a9
MD5 7769c2773616ae86f7ab4b83f57f81a1
SHA1 11c60d18bad7b4489f6871fbff0a625060573094
SHA512 e1f1fdf43b878bfeefdef6aed8461622b4ec94a13a10e88a71997099aabfcb13faad407458b4af3b66542853869823bfebaf73d8b905adbb7279ea99cc3a5fa6
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrc:k7ICteErownP0oTcMsABqlkgcz4
TLSH
T14C463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4700-659-0x0000029307910000-0x0000029307C5D000-memory.dmp

Download

memory/6008-1027-0x000001FAE6A20000-0x000001FAE6D6D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads